HttpOnly harbor.session cookie.